Read the docs
TI-2022-15979 Aliases CVE-2022-35403GHSA-7xjv-9887-fp87

Zoho ManageEngine ServiceDesk Plus before 13008, ServiceDesk Plus MSP before 10606, and…

Priority MEDIUM 42Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · None · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

Zoho ManageEngine ServiceDesk Plus before 13008, ServiceDesk Plus MSP before 10606, and SupportCenter Plus before 11022 are affected by an unauthenticated local file disclosure vulnerability via ticket-creation email. (This also affects Asset Explorer before 6977 with authentication.)

Why it matters now

EPSS 0.06205 93rd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 65

CPEVersionsRoleVendor
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:*:*:*:*:*:*:*:*before 13.0VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:13.0:13000:*:*:*:*:*:*13.0 13000VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:13.0:13001:*:*:*:*:*:*13.0 13001VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:13.0:13002:*:*:*:*:*:*13.0 13002VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:13.0:13003:*:*:*:*:*:*13.0 13003VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:13.0:13004:*:*:*:*:*:*13.0 13004VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:13.0:13005:*:*:*:*:*:*13.0 13005VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:13.0:13006:*:*:*:*:*:*13.0 13006VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:13.0:13007:*:*:*:*:*:*13.0 13007VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:*:*:*:*:*:*:*:*before 10.6VulnerableZohocorp
  • cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:*:*:*:*:*:*:*:* Versions before 13.0 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:13.0:13000:*:*:*:*:*:* Versions 13.0 13000 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:13.0:13001:*:*:*:*:*:* Versions 13.0 13001 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:13.0:13002:*:*:*:*:*:* Versions 13.0 13002 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:13.0:13003:*:*:*:*:*:* Versions 13.0 13003 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:13.0:13004:*:*:*:*:*:* Versions 13.0 13004 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:13.0:13005:*:*:*:*:*:* Versions 13.0 13005 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:13.0:13006:*:*:*:*:*:* Versions 13.0 13006 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:13.0:13007:*:*:*:*:*:* Versions 13.0 13007 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:*:*:*:*:*:*:*:* Versions before 10.6 Vulnerable ·Zohocorp
Show 55 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:10.6:10600:*:*:*:*:*:*10.6 10600VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:10.6:10601:*:*:*:*:*:*10.6 10601VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:10.6:10602:*:*:*:*:*:*10.6 10602VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:10.6:10603:*:*:*:*:*:*10.6 10603VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:10.6:10604:*:*:*:*:*:*10.6 10604VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:10.6:10605:*:*:*:*:*:*10.6 10605VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_supportcenter_plus:*:*:*:*:*:*:*:*before 11.0VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_supportcenter_plus:11.0:11000:*:*:*:*:*:*11.0 11000VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_supportcenter_plus:11.0:11001:*:*:*:*:*:*11.0 11001VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_supportcenter_plus:11.0:11002:*:*:*:*:*:*11.0 11002VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_supportcenter_plus:11.0:11003:*:*:*:*:*:*11.0 11003VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_supportcenter_plus:11.0:11004:*:*:*:*:*:*11.0 11004VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_supportcenter_plus:11.0:11005:*:*:*:*:*:*11.0 11005VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_supportcenter_plus:11.0:11006:*:*:*:*:*:*11.0 11006VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_supportcenter_plus:11.0:11007:*:*:*:*:*:*11.0 11007VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_supportcenter_plus:11.0:11008:*:*:*:*:*:*11.0 11008VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_supportcenter_plus:11.0:11009:*:*:*:*:*:*11.0 11009VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_supportcenter_plus:11.0:11010:*:*:*:*:*:*11.0 11010VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_supportcenter_plus:11.0:11011:*:*:*:*:*:*11.0 11011VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_supportcenter_plus:11.0:11012:*:*:*:*:*:*11.0 11012VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_supportcenter_plus:11.0:11013:*:*:*:*:*:*11.0 11013VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_supportcenter_plus:11.0:11014:*:*:*:*:*:*11.0 11014VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_supportcenter_plus:11.0:11015:*:*:*:*:*:*11.0 11015VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_supportcenter_plus:11.0:11016:*:*:*:*:*:*11.0 11016VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_supportcenter_plus:11.0:11017:*:*:*:*:*:*11.0 11017VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_supportcenter_plus:11.0:11018:*:*:*:*:*:*11.0 11018VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_supportcenter_plus:11.0:11019:*:*:*:*:*:*11.0 11019VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_supportcenter_plus:11.0:11020:*:*:*:*:*:*11.0 11020VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_supportcenter_plus:11.0:11021:*:*:*:*:*:*11.0 11021VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_assetexplorer:*:*:*:*:*:*:*:*before 6.9VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6900:*:*:*:*:*:*6.9 6900VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6901:*:*:*:*:*:*6.9 6901VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6902:*:*:*:*:*:*6.9 6902VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6903:*:*:*:*:*:*6.9 6903VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6904:*:*:*:*:*:*6.9 6904VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6905:*:*:*:*:*:*6.9 6905VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6906:*:*:*:*:*:*6.9 6906VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6907:*:*:*:*:*:*6.9 6907VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6908:*:*:*:*:*:*6.9 6908VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6909:*:*:*:*:*:*6.9 6909VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6950:*:*:*:*:*:*6.9 6950VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6951:*:*:*:*:*:*6.9 6951VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6952:*:*:*:*:*:*6.9 6952VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6953:*:*:*:*:*:*6.9 6953VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6954:*:*:*:*:*:*6.9 6954VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6955:*:*:*:*:*:*6.9 6955VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6956:*:*:*:*:*:*6.9 6956VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6957:*:*:*:*:*:*6.9 6957VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6970:*:*:*:*:*:*6.9 6970VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6971:*:*:*:*:*:*6.9 6971VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6972:*:*:*:*:*:*6.9 6972VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6973:*:*:*:*:*:*6.9 6973VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6974:*:*:*:*:*:*6.9 6974VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6975:*:*:*:*:*:*6.9 6975VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6976:*:*:*:*:*:*6.9 6976VulnerableZohocorp
  • cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:10.6:10600:*:*:*:*:*:* Versions 10.6 10600 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:10.6:10601:*:*:*:*:*:* Versions 10.6 10601 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:10.6:10602:*:*:*:*:*:* Versions 10.6 10602 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:10.6:10603:*:*:*:*:*:* Versions 10.6 10603 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:10.6:10604:*:*:*:*:*:* Versions 10.6 10604 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:10.6:10605:*:*:*:*:*:* Versions 10.6 10605 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_supportcenter_plus:*:*:*:*:*:*:*:* Versions before 11.0 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_supportcenter_plus:11.0:11000:*:*:*:*:*:* Versions 11.0 11000 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_supportcenter_plus:11.0:11001:*:*:*:*:*:* Versions 11.0 11001 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_supportcenter_plus:11.0:11002:*:*:*:*:*:* Versions 11.0 11002 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_supportcenter_plus:11.0:11003:*:*:*:*:*:* Versions 11.0 11003 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_supportcenter_plus:11.0:11004:*:*:*:*:*:* Versions 11.0 11004 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_supportcenter_plus:11.0:11005:*:*:*:*:*:* Versions 11.0 11005 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_supportcenter_plus:11.0:11006:*:*:*:*:*:* Versions 11.0 11006 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_supportcenter_plus:11.0:11007:*:*:*:*:*:* Versions 11.0 11007 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_supportcenter_plus:11.0:11008:*:*:*:*:*:* Versions 11.0 11008 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_supportcenter_plus:11.0:11009:*:*:*:*:*:* Versions 11.0 11009 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_supportcenter_plus:11.0:11010:*:*:*:*:*:* Versions 11.0 11010 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_supportcenter_plus:11.0:11011:*:*:*:*:*:* Versions 11.0 11011 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_supportcenter_plus:11.0:11012:*:*:*:*:*:* Versions 11.0 11012 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_supportcenter_plus:11.0:11013:*:*:*:*:*:* Versions 11.0 11013 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_supportcenter_plus:11.0:11014:*:*:*:*:*:* Versions 11.0 11014 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_supportcenter_plus:11.0:11015:*:*:*:*:*:* Versions 11.0 11015 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_supportcenter_plus:11.0:11016:*:*:*:*:*:* Versions 11.0 11016 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_supportcenter_plus:11.0:11017:*:*:*:*:*:* Versions 11.0 11017 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_supportcenter_plus:11.0:11018:*:*:*:*:*:* Versions 11.0 11018 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_supportcenter_plus:11.0:11019:*:*:*:*:*:* Versions 11.0 11019 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_supportcenter_plus:11.0:11020:*:*:*:*:*:* Versions 11.0 11020 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_supportcenter_plus:11.0:11021:*:*:*:*:*:* Versions 11.0 11021 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_assetexplorer:*:*:*:*:*:*:*:* Versions before 6.9 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6900:*:*:*:*:*:* Versions 6.9 6900 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6901:*:*:*:*:*:* Versions 6.9 6901 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6902:*:*:*:*:*:* Versions 6.9 6902 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6903:*:*:*:*:*:* Versions 6.9 6903 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6904:*:*:*:*:*:* Versions 6.9 6904 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6905:*:*:*:*:*:* Versions 6.9 6905 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6906:*:*:*:*:*:* Versions 6.9 6906 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6907:*:*:*:*:*:* Versions 6.9 6907 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6908:*:*:*:*:*:* Versions 6.9 6908 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6909:*:*:*:*:*:* Versions 6.9 6909 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6950:*:*:*:*:*:* Versions 6.9 6950 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6951:*:*:*:*:*:* Versions 6.9 6951 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6952:*:*:*:*:*:* Versions 6.9 6952 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6953:*:*:*:*:*:* Versions 6.9 6953 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6954:*:*:*:*:*:* Versions 6.9 6954 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6955:*:*:*:*:*:* Versions 6.9 6955 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6956:*:*:*:*:*:* Versions 6.9 6956 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6957:*:*:*:*:*:* Versions 6.9 6957 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6970:*:*:*:*:*:* Versions 6.9 6970 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6971:*:*:*:*:*:* Versions 6.9 6971 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6972:*:*:*:*:*:* Versions 6.9 6972 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6973:*:*:*:*:*:* Versions 6.9 6973 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6974:*:*:*:*:*:* Versions 6.9 6974 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6975:*:*:*:*:*:* Versions 6.9 6975 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_assetexplorer:6.9:6976:*:*:*:*:*:* Versions 6.9 6976 Vulnerable ·Zohocorp

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-35403
  2. 2026-10-03 Alias added: GHSA-7xjv-9887-fp87

References

Patch 1

  • TI-2022-23765 Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003… KEVCVSS 3.1CRITICAL 9.8
  • TI-2023-11733 Zoho ManageEngine ServiceDesk Plus through 14104, Asset Explorer through 6987… CVSS 3.1HIGH 7.5
  • TI-2021-03410 Integer overflow in Manage Engine Asset Explorer Agent CVSS 3.1CRITICAL 9.8
  • TI-2019-09733 Server Side Request Forgery (SSRF) exists in Zoho ManageEngine AssetExplorer version… CVSS 3.0CRITICAL 9.1
  • TI-2019-10915 Zoho ManageEngine AssetExplorer 6.2.0 is vulnerable to an XML External Entity Injection… CVSS 3.0HIGH 8.5
  • TI-2019-09702 Server Side Request Forgery (SSRF) exists in Zoho ManageEngine AssetExplorer 6.2.0 and… CVSS 3.0HIGH 8.8
See all 25 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences